Introduction
Understanding organizationsBest practices: organization designUnderstanding componentsManage organizationsManage componentsManage component Jira integrationsOrganization inheritance reference
Understanding users and teamsUnderstanding role-based access controlManage usersManage teamsConfigure role-based access controlRBAC permissions reference
Understanding authentication in CloudBees UnifyPersonal access tokensManage personal access tokensSet up multifactor authenticationConfigure SAML single sign-onConfigure OIDC authenticationConfigure network security policiesNetwork security reference
Understanding platform configurationUnderstanding environmentsManage properties and secretsManage environmentsTrack environment inventoryConfigure containersSet up preconfigured actionsConfigure notificationsSet up Slack webhook notifications
Accessibility policy referenceShared responsibility model referenceSubscription and services agreementSupport policiesSupported browsers and external tools
Introduction
Understanding application security posture managementUnderstanding Jira ticket creationUnderstanding security center workflowsConfigure security toolsConfigure implicit security analysisConfigure Jira ticketing for an applicationConfigure SBOM analysisDefine security SLAsTriage security findingsUse the organization security dashboardUse the component security centerUse the application security centerUse security overview
Get started with security scanningConfigure SAST scanningConfigure DAST scanningConfigure container scanningConfigure SCA scanningConfigure secret scanningConfigure IaC scanningVerify CloudBees action image signatures and SLSA attestationsSecurity scanner referenceSecurity findings taxonomySecurity scanners and integrations
Introduction
Actions catalog
Understanding workflowsCreate a build workflowCreate and manage workflowsCreate reusable workflowsTrigger workflows remotely
View pending approval tasks in your inboxMonitor workflow runsView test results in runsView evidence in runsView deployments in runsManage workflow artifacts
Understanding custom actionsCreate a custom action
Configure workflow credentialsConfigure AWS credentialsConfigure container registry credentialsConfigure Git credentialsIntegrate CyberArk Conjur secrets
Check out source codeBuild and publish container imagesTest and validate containers in workflows
Publish test resultsPublish evidence itemsGenerate a software bill of materialsManage ServiceNow change requestsServiceNow actions reference
Workflow syntax referenceJobs syntax referenceSteps syntax referenceServices syntax reference
Introduction
Understanding release orchestrationManage applicationsCreate deployer workflowsCreate staged workflowsCreate and manage releasesOrchestrate multi-workflow releasesRelease management reference
Understanding artifact managementRegister and track artifactsStore and retrieve artifactsPromote artifactsGenerate a software bill of materialsArtifact management reference
Deploy with HelmDeploy to KubernetesContainer deployment reference
Deploy to AWSAWS deployment reference
Deploy with enterprise platformsExecute remote deployment commandsEnterprise deployment reference
Verify deployments with New RelicDeployment verification reference
Introduction
Understanding feature managementUnderstanding Configuration as CodeGet started with feature managementCreate and manage feature flagsConfigure feature flag targetingOrganize feature flagsImplement feature flag governanceEnable secret modeConfiguration as Code reference
Understanding flag impressions and activity statusUnderstanding flag healthUnderstanding code referencesReview and clean up feature flagsSet up code references
Understanding Jira integration for feature flagsSet up the Jira integrationLink Jira tickets to feature flags
Understanding multiple SDK keysBuild your first mobile app with feature flagsBuild your first feature-flagged web applicationBuild your first feature-flagged backend serviceInstall client-side SDKsInstall server-side SDKsConfigure multiple SDK keysFlag implementation reference
Backend SDK referenceGo SDK referenceJava SDK referencePython SDK referenceRuby SDK referencePHP SDK reference.NET/C# (server-side) SDK referenceNode.js SDK referenceMobile SDK referenceAndroid SDK referenceiOS/tvOS SDK referenceObjective-C SDK referenceSwift SDK referenceReact Native SDK referenceWeb SDK referenceJavaScript (browser) SDK referenceJavaScript SSR SDK referenceClient SDK referenceJava client SDK reference.NET/C# (client-side) SDK referenceC (server-side) SDK referenceC++ (server-side) SDK referenceC (client-side) SDK referenceC++ client SDK reference

Security scanners and integrations

3 minute read
Reference— Information-oriented: exact details, structured for lookup.

This page lists the available security scanning tools supported by application security posture management (ASPM) in CloudBees Unify.

It includes supported security scanners, their scan categories, whether they run implicitly, explicitly, or both, and how they are invoked.

For detailed information about scanning tools, their input parameters, usage examples, and scanning concepts, refer to the following resources:

Tools are supported for the following types of security scanner:

SAST scanners

Static Application Security Testing (SAST) scanners analyze source code without executing it to identify potential security vulnerabilities, coding errors, and adherence to security best practices.

Supported SAST scanners
Tool Vendor Implicit Action Explicit CloudBees actions Explicit GitHub Action Notes

FindSecBugs

Arteau

Available

Available

—

Java source and bytecode analysis. OSS, bundled.

Gosec

Securego

Available

Available

Available

Go source analysis. OSS, bundled.

Njsscan

Abraham

Available

Available

—

Node.js source analysis. OSS, bundled.

Checkmarx SAST

Checkmarx

—

Available

—

Enterprise.

Checkmarx One SAST

Checkmarx

Available

—

—

Enterprise.

SonarQube

Sonarsource

Available

plugin bundled

—

Enterprise, bundled. Implicit scan does not support Java; use the explicit plugin for Java.

Mend SAST

Mend

—

Available

—

Enterprise.

Snyk Code

Snyk

Available

Available

—

—

Coverity Polaris

Black Duck

Available

—

Available

Enterprise.

Klocwork

Perforce

Available

—

Available

Enterprise. Must be configured in the Marketplace before implicit use.

Secret scanners

Secret scanners detect exposed credentials, API keys, tokens, and other sensitive content in source code, containers, and object storage.

Secret scanners
Tool Vendor Implicit Action (Yes/No) Explicit CloudBees actions Explicit GitHub Action Notes

Gitleaks

Rice

Available

Available

Available

Scans Git repositories for credentials, API keys, and tokens. OSS, bundled.

GitHub Advanced Security

GitHub

—

Available

—

—

TruffleHog

Truffle Security

—

Trufflehog code

Trufflehog container

Trufflehog s3

—

Scans code, S3, repositories, and CI/CD logs. OSS supports explicit scans only;

Container scanners

Container scanners analyze container images for known vulnerabilities, secrets, and risks in operating system and language packages.

Container scanners
Tool Vendor Implicit Action Explicit CloudBees actions Explicit GitHub Action Notes

Grype

Anchore

Configure binary security analysis

—

Grype

Identifies vulnerabilities and secrets in OS and packages within the image. OSS, bundled.

Trivy

Aqua Security

Configure binary security analysis

Trivy

Trivy

Identifies vulnerabilities and secrets in OS and packages within the image. OSS, bundled.

Anchore Enterprise

Anchore

—

Anchore

—

—

Snyk Container

Snyk

—

Snyk container

—

—

Aqua Container Security

Aqua Security

—

Aquasec

—

—

JFrog Xray

JFrog

—

Jfrog xray

—

—

SCA scanners

Software Composition Analysis (SCA) scanners identify open-source and third-party dependencies, and assess them for known vulnerabilities and license risk.

SCA scanners
Tool Vendor Implicit Action Explicit CloudBees actions Explicit GitHub Action Notes

Snyk Open Source

Snyk

Configure code security analysis

Snyk SCA

Snyk SCA

—

Black Duck SCA

Black Duck

Configure code security analysis

Black duck

Black duck

—

Nexus IQ

Sonatype

—

SAST container

—

—

Mend SCA

Mend

—

Mend SCA

—

—

JFrog Xray

JFrog

—

Jfrog Xray

—

—

Dependabot

GitHub

—

—

—

Dependency scanning.

SBOM generation

Software Bill of Materials (SBOM) generators produce a manifest of components within a container image or binary, most effective when paired with a vulnerability scanner.

SBOM generation
Tool Vendor Implicit Action Explicit CloudBees actions Explicit GitHub Action Notes

Syft

Anchore

Configure SBOM analysis

—

—

Generates an SBOM from container images and filesystems. Pairs with Grype for vulnerability detection. OSS, bundled.

Language analysis

Language analyzers determine the language composition of a repository, which influences which scanners are invoked for a given codebase.

Language analysis
Tool Vendor Implicit Action Explicit Cloudbees Action Explicit Github Action Notes

SCC

Boyter

Configure code security analysis

—

—

Identifies about 350 languages in a repository. Determines which scanners are invoked. Enabled by default. OSS, bundled.

Related pages

Security findings taxonomy